pickSmallest/pickLargest heuristics in JarIdentificationAnalysis may select wrong values

In `JarIdentificationAnalysis.java:78-105`, the `normalize()` method uses `pickSmallest()` to select the version and `pickLargest()` to select artifactId/name/vendor:

```java
private String pickSmallest(List values) {
String result = null;
for (String value : values) {
if (result == null || value.length() < result.length()) {
result = value;
}
}
return result;
}

private String pickLargest(List values) {
String result = null;
for (String value : values) {
if (result == null || value.length() > result.length()) {
result = value;
}
}
return result;
}
```

These are arbitrary string-length-based heuristics:
- **For version**: `pickSmallest()` selects the shortest string. For example, `"1.0"` (3 chars) would be chosen over `"1.0.3"` (5 chars) or `"20030519"` (8 chars), potentially discarding the actual version.
- **For artifactId**: `pickLargest()` selects the longest match, which may pick the most qualified but potentially incorrect name.

These heuristics can produce wrong results when multiple candidate values are identified from different sources. A more robust approach would be needed for reliable identification.

Start by reading JarIdentificationAnalysis.java:78-105, focusing on normalize(), pickSmallest(), and pickLargest(). Trace how candidate values from different sources are selected, then define and verify a reliable selection strategy that preserves the correct version, artifactId, name, and vendor values.

Written by the indexing model from the issue text.